edit: Good grief, should be spear phishing emails.
I found two similar emails in my spam, sent in quick succession, that on the face of it looked like from family members that I have very little contact with by email - they sent suspicious links to photos. When I checked the email addresses they were clearly wrong and the emails were spear phishing
How do phishers know the two names? Both are people I haven’t emailed in years. Who’s side is compromised, theirs (both of them at the same time?) or mine?